Refactoring: Make QuicSignedServerConfig contain a QuicCryptoProof

net/quic/core/crypto/quic_crypto_server_config.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/core/crypto/quic_crypto_server_config.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 443 matching lines @@
     }
 
     requested_config = GetConfigWithScid(requested_scid);
     primary_config = primary_config_;
     signed_config->config = primary_config_;
   }
 
   if (result->error_code == QUIC_NO_ERROR) {
     // QUIC requires a new proof for each CHLO so clear any existing proof.
     signed_config->chain = nullptr;
-    signed_config->signature = "";
-    signed_config->cert_sct = "";
+    signed_config->proof.signature = "";
+    signed_config->proof.leaf_cert_scts = "";
     EvaluateClientHello(server_ip, version, requested_config, primary_config,
                         signed_config, result, std::move(done_cb));
   } else {
     done_cb->Run(result, /* details = */ nullptr);
   }
 }
 
 class ProcessClientHelloHelper {
  public:
   explicit ProcessClientHelloHelper(
@@ skipping 71 matching lines @@
         requested_config_(requested_config),
         primary_config_(primary_config),
         done_cb_(std::move(done_cb)) {}
 
   void Run(bool ok,
            const scoped_refptr<ProofSource::Chain>& chain,
            const QuicCryptoProof& proof,
            std::unique_ptr<ProofSource::Details> details) override {
     if (ok) {
       signed_config_->chain = chain;
-      signed_config_->signature = proof.signature;
-      signed_config_->cert_sct = proof.leaf_cert_scts;
-      signed_config_->send_expect_ct_header = proof.send_expect_ct_header;
+      signed_config_->proof = proof;
     }
     config_->ProcessClientHelloAfterGetProof(
         !ok, std::move(details), *validate_chlo_result_, reject_only_,
         connection_id_, client_address_, version_, supported_versions_,
         use_stateless_rejects_, server_designated_connection_id_, clock_, rand_,
         compressed_certs_cache_, params_, signed_config_,
         total_framing_overhead_, chlo_packet_size_, requested_config_,
         primary_config_, std::move(done_cb_));
   }
 
@@ skipping 125 matching lines @@
     }
 
     QuicCryptoProof proof;
     if (!proof_source_->GetProof(server_ip, info.sni.as_string(),
                                  primary_config->serialized, version, chlo_hash,
                                  connection_options, &signed_config->chain,
                                  &proof)) {
       helper.Fail(QUIC_HANDSHAKE_FAILED, "Missing or invalid crypto proof.");
       return;
     }
-    signed_config->signature = proof.signature;
-    signed_config->cert_sct = proof.leaf_cert_scts;
+    signed_config->proof = proof;
   }
 
   helper.DetachCallback();
   ProcessClientHelloAfterGetProof(
       /* found_error = */ false, /* proof_source_details = */ nullptr,
       *validate_chlo_result, reject_only, connection_id, client_address,
       version, supported_versions, use_stateless_rejects,
       server_designated_connection_id, clock, rand, compressed_certs_cache,
       params, signed_config, total_framing_overhead, chlo_packet_size,
       requested_config, primary_config, std::move(done_cb));
@@ skipping 424 matching lines @@
         signed_config_(signed_config),
         client_hello_state_(std::move(client_hello_state)),
         done_cb_(std::move(done_cb)) {}
 
   void Run(bool ok,
            const scoped_refptr<ProofSource::Chain>& chain,
            const QuicCryptoProof& proof,
            std::unique_ptr<ProofSource::Details> details) override {
     if (ok) {
       signed_config_->chain = chain;
-      signed_config_->signature = proof.signature;
-      signed_config_->cert_sct = proof.leaf_cert_scts;
-      signed_config_->send_expect_ct_header = proof.send_expect_ct_header;
+      signed_config_->proof = proof;
     }
     config_.EvaluateClientHelloAfterGetProof(
         found_error_, server_ip_, version_, requested_config_, primary_config_,
         signed_config_, std::move(details), !ok, client_hello_state_,
         std::move(done_cb_));
   }
 
  private:
   const QuicCryptoServerConfig& config_;
   const bool found_error_;
@@ skipping 107 matching lines @@
     }
   }
 
   // No need to get a new proof if one was already generated.
   if (need_proof) {
     QuicCryptoProof proof;
 
     if (proof_source_->GetProof(
             server_ip, info->sni.as_string(), serialized_config, version,
             chlo_hash, connection_options, &signed_config->chain, &proof)) {
-      signed_config->signature = proof.signature;
-      signed_config->cert_sct = proof.leaf_cert_scts;
+      signed_config->proof = proof;
     } else {
       get_proof_failed = true;
     }
   }
 
   // Details are null because the synchronous version of GetProof does not
   // return any stats.  Eventually the synchronous codepath will be eliminated.
   EvaluateClientHelloAfterGetProof(
       found_error, server_ip, version, requested_config, primary_config,
       signed_config, nullptr /* proof_source_details */, get_proof_failed,
@@ skipping 289 matching lines @@
   // max_unverified_size is the number of bytes that the certificate chain,
   // signature, and (optionally) signed certificate timestamp can consume before
   // we will demand a valid source-address token.
   const size_t max_unverified_size =
       chlo_multiplier_ * (chlo_packet_size - total_framing_overhead) -
       kREJOverheadBytes;
   static_assert(kClientHelloMinimumSize * kMultiplier >= kREJOverheadBytes,
                 "overhead calculation may underflow");
   bool should_return_sct =
       params->sct_supported_by_client && enable_serving_sct_;
-  const size_t sct_size = should_return_sct ? signed_config.cert_sct.size() : 0;
+  const string& cert_sct = signed_config.proof.leaf_cert_scts;
+  const size_t sct_size = should_return_sct ? cert_sct.size() : 0;
   const size_t total_size =
-      signed_config.signature.size() + compressed.size() + sct_size;
+      signed_config.proof.signature.size() + compressed.size() + sct_size;
   if (info.valid_source_address_token || total_size < max_unverified_size) {
     out->SetStringPiece(kCertificateTag, compressed);
-    out->SetStringPiece(kPROF, signed_config.signature);
+    out->SetStringPiece(kPROF, signed_config.proof.signature);
     if (should_return_sct) {
-      if (signed_config.cert_sct.empty()) {
+      if (cert_sct.empty()) {
         DLOG(WARNING) << "SCT is expected but it is empty.";
       } else {
-        out->SetStringPiece(kCertificateSCTTag, signed_config.cert_sct);
+        out->SetStringPiece(kCertificateSCTTag, cert_sct);
       }
     }
   } else {
     DLOG(WARNING) << "Sending inchoate REJ for hostname: " << info.sni
-                  << " signature: " << signed_config.signature.size()
+                  << " signature: " << signed_config.proof.signature.size()
                   << " cert: " << compressed.size() << " sct:" << sct_size
                   << " total: " << total_size
                   << " max: " << max_unverified_size;
   }
 }
 
 string QuicCryptoServerConfig::CompressChain(
     QuicCompressedCertsCache* compressed_certs_cache,
     const scoped_refptr<ProofSource::Chain>& chain,
     const string& client_common_set_hashes,
@@ skipping 388 matching lines @@
     : channel_id_enabled(false),
       is_primary(false),
       primary_time(QuicWallTime::Zero()),
       expiry_time(QuicWallTime::Zero()),
       priority(0),
       source_address_token_boxer(nullptr) {}
 
 QuicCryptoServerConfig::Config::~Config() {
 }
 
-QuicSignedServerConfig::QuicSignedServerConfig()
-    : send_expect_ct_header(false) {}
+QuicSignedServerConfig::QuicSignedServerConfig() {}
 QuicSignedServerConfig::~QuicSignedServerConfig() {}
 
 }  // namespace net